604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b

Analysis

max time kernel
152s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
Size

255KB
MD5

36aced954a82292490e98f4ce0ca5720
SHA1

857fd81aa5a71b6e1e47e121eace3a968f2ee374
SHA256

604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b
SHA512

ee2a10e5e8832919390ffe7659113aac5f1693e768cfa7d584c7390bffcf1ce5b3cde195bcace85bb0934ae7f7ae00580fd2e184871f47f56fa34acbb05c68ef
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJY:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIH

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

glzzmmfneo.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	glzzmmfneo.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

glzzmmfneo.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	glzzmmfneo.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

glzzmmfneo.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	glzzmmfneo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	glzzmmfneo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	glzzmmfneo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	glzzmmfneo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	glzzmmfneo.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

glzzmmfneo.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	glzzmmfneo.exe

Executes dropped EXE 5 IoCs

Processes:

glzzmmfneo.exelqtvszjkltcexgh.exealeomyqr.exehhqjbzoligihs.exealeomyqr.exe

pid process

948 glzzmmfneo.exe
772 lqtvszjkltcexgh.exe
768 aleomyqr.exe
1076 hhqjbzoligihs.exe
860 aleomyqr.exe

pid	process
948	glzzmmfneo.exe
772	lqtvszjkltcexgh.exe
768	aleomyqr.exe
1076	hhqjbzoligihs.exe
860	aleomyqr.exe

UPX packed file 31 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\SysWOW64\glzzmmfneo.exe	upx
C:\Windows\SysWOW64\glzzmmfneo.exe	upx
C:\Windows\SysWOW64\glzzmmfneo.exe	upx
\Windows\SysWOW64\lqtvszjkltcexgh.exe	upx
C:\Windows\SysWOW64\lqtvszjkltcexgh.exe	upx
C:\Windows\SysWOW64\lqtvszjkltcexgh.exe	upx
\Windows\SysWOW64\aleomyqr.exe	upx
C:\Windows\SysWOW64\aleomyqr.exe	upx
C:\Windows\SysWOW64\aleomyqr.exe	upx
\Windows\SysWOW64\hhqjbzoligihs.exe	upx
C:\Windows\SysWOW64\hhqjbzoligihs.exe	upx
C:\Windows\SysWOW64\hhqjbzoligihs.exe	upx
behavioral1/memory/1792-75-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/948-77-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Windows\SysWOW64\aleomyqr.exe	upx
behavioral1/memory/772-80-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/768-83-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
\Windows\SysWOW64\aleomyqr.exe	upx
behavioral1/memory/1076-84-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1792-86-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/860-93-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/948-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/772-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/768-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1076-98-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/860-99-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	upx
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	upx
C:\Users\Admin\AppData\Roaming\ReceiveStart.doc.exe	upx
\??\c:\Users\Admin\AppData\Roaming\ReceiveStart.doc.exe	upx
C:\Users\Admin\Music\RepairAssert.doc.exe	upx

Loads dropped DLL 5 IoCs

Processes:

604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exeglzzmmfneo.exe

pid	process
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
948	glzzmmfneo.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

glzzmmfneo.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	glzzmmfneo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	glzzmmfneo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	glzzmmfneo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	glzzmmfneo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	glzzmmfneo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	glzzmmfneo.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

lqtvszjkltcexgh.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	lqtvszjkltcexgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cqtxfazi = "glzzmmfneo.exe"	lqtvszjkltcexgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qgagpaxo = "lqtvszjkltcexgh.exe"	lqtvszjkltcexgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "hhqjbzoligihs.exe"	lqtvszjkltcexgh.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

aleomyqr.exeglzzmmfneo.exealeomyqr.exe

description	ioc	process
File opened (read-only)	\??\k:	aleomyqr.exe
File opened (read-only)	\??\l:	aleomyqr.exe
File opened (read-only)	\??\v:	aleomyqr.exe
File opened (read-only)	\??\s:	glzzmmfneo.exe
File opened (read-only)	\??\m:	aleomyqr.exe
File opened (read-only)	\??\b:	aleomyqr.exe
File opened (read-only)	\??\f:	aleomyqr.exe
File opened (read-only)	\??\z:	aleomyqr.exe
File opened (read-only)	\??\q:	glzzmmfneo.exe
File opened (read-only)	\??\q:	aleomyqr.exe
File opened (read-only)	\??\g:	aleomyqr.exe
File opened (read-only)	\??\j:	aleomyqr.exe
File opened (read-only)	\??\a:	aleomyqr.exe
File opened (read-only)	\??\o:	aleomyqr.exe
File opened (read-only)	\??\l:	glzzmmfneo.exe
File opened (read-only)	\??\m:	glzzmmfneo.exe
File opened (read-only)	\??\r:	glzzmmfneo.exe
File opened (read-only)	\??\w:	glzzmmfneo.exe
File opened (read-only)	\??\x:	aleomyqr.exe
File opened (read-only)	\??\y:	aleomyqr.exe
File opened (read-only)	\??\q:	aleomyqr.exe
File opened (read-only)	\??\r:	aleomyqr.exe
File opened (read-only)	\??\g:	glzzmmfneo.exe
File opened (read-only)	\??\n:	glzzmmfneo.exe
File opened (read-only)	\??\f:	aleomyqr.exe
File opened (read-only)	\??\p:	aleomyqr.exe
File opened (read-only)	\??\s:	aleomyqr.exe
File opened (read-only)	\??\n:	aleomyqr.exe
File opened (read-only)	\??\b:	glzzmmfneo.exe
File opened (read-only)	\??\e:	aleomyqr.exe
File opened (read-only)	\??\k:	aleomyqr.exe
File opened (read-only)	\??\y:	glzzmmfneo.exe
File opened (read-only)	\??\r:	aleomyqr.exe
File opened (read-only)	\??\h:	glzzmmfneo.exe
File opened (read-only)	\??\h:	aleomyqr.exe
File opened (read-only)	\??\i:	aleomyqr.exe
File opened (read-only)	\??\m:	aleomyqr.exe
File opened (read-only)	\??\s:	aleomyqr.exe
File opened (read-only)	\??\u:	aleomyqr.exe
File opened (read-only)	\??\x:	aleomyqr.exe
File opened (read-only)	\??\t:	aleomyqr.exe
File opened (read-only)	\??\p:	aleomyqr.exe
File opened (read-only)	\??\e:	glzzmmfneo.exe
File opened (read-only)	\??\k:	glzzmmfneo.exe
File opened (read-only)	\??\p:	glzzmmfneo.exe
File opened (read-only)	\??\x:	glzzmmfneo.exe
File opened (read-only)	\??\z:	aleomyqr.exe
File opened (read-only)	\??\g:	aleomyqr.exe
File opened (read-only)	\??\h:	aleomyqr.exe
File opened (read-only)	\??\l:	aleomyqr.exe
File opened (read-only)	\??\b:	aleomyqr.exe
File opened (read-only)	\??\i:	aleomyqr.exe
File opened (read-only)	\??\t:	aleomyqr.exe
File opened (read-only)	\??\w:	aleomyqr.exe
File opened (read-only)	\??\f:	glzzmmfneo.exe
File opened (read-only)	\??\i:	glzzmmfneo.exe
File opened (read-only)	\??\j:	glzzmmfneo.exe
File opened (read-only)	\??\z:	glzzmmfneo.exe
File opened (read-only)	\??\o:	aleomyqr.exe
File opened (read-only)	\??\v:	aleomyqr.exe
File opened (read-only)	\??\y:	aleomyqr.exe
File opened (read-only)	\??\a:	glzzmmfneo.exe
File opened (read-only)	\??\o:	glzzmmfneo.exe
File opened (read-only)	\??\v:	glzzmmfneo.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

glzzmmfneo.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	glzzmmfneo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	glzzmmfneo.exe

AutoIT Executable 13 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1792-75-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/948-77-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/772-80-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/768-83-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1076-84-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1792-86-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/948-92-0x0000000003CC0000-0x0000000003D60000-memory.dmp	autoit_exe
behavioral1/memory/860-93-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/948-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/772-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/768-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1076-98-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/860-99-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exeglzzmmfneo.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hhqjbzoligihs.exe	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
File created	C:\Windows\SysWOW64\glzzmmfneo.exe	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
File opened for modification	C:\Windows\SysWOW64\glzzmmfneo.exe	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
File created	C:\Windows\SysWOW64\aleomyqr.exe	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
File opened for modification	C:\Windows\SysWOW64\hhqjbzoligihs.exe	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	glzzmmfneo.exe
File created	C:\Windows\SysWOW64\lqtvszjkltcexgh.exe	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
File opened for modification	C:\Windows\SysWOW64\lqtvszjkltcexgh.exe	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
File opened for modification	C:\Windows\SysWOW64\aleomyqr.exe	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe

Drops file in Program Files directory 14 IoCs

Processes:

aleomyqr.exealeomyqr.exe

description	ioc	process
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	aleomyqr.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	aleomyqr.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	aleomyqr.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	aleomyqr.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	aleomyqr.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	aleomyqr.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	aleomyqr.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	aleomyqr.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	aleomyqr.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	aleomyqr.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	aleomyqr.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	aleomyqr.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	aleomyqr.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	aleomyqr.exe

Drops file in Windows directory 5 IoCs

Processes:

WINWORD.EXE604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\mydoc.rtf	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXEglzzmmfneo.exe604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	glzzmmfneo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	glzzmmfneo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	glzzmmfneo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	glzzmmfneo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33442C0F9D2382556A3176DD70202CA97DF464D6"	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	glzzmmfneo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1552 WINWORD.EXE

pid	process
1552	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exeglzzmmfneo.exelqtvszjkltcexgh.exealeomyqr.exehhqjbzoligihs.exealeomyqr.exe

pid	process
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
948	glzzmmfneo.exe
948	glzzmmfneo.exe
948	glzzmmfneo.exe
948	glzzmmfneo.exe
948	glzzmmfneo.exe
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
772	lqtvszjkltcexgh.exe
772	lqtvszjkltcexgh.exe
772	lqtvszjkltcexgh.exe
772	lqtvszjkltcexgh.exe
768	aleomyqr.exe
768	aleomyqr.exe
768	aleomyqr.exe
768	aleomyqr.exe
772	lqtvszjkltcexgh.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
772	lqtvszjkltcexgh.exe
860	aleomyqr.exe
860	aleomyqr.exe
860	aleomyqr.exe
860	aleomyqr.exe
772	lqtvszjkltcexgh.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
772	lqtvszjkltcexgh.exe
772	lqtvszjkltcexgh.exe
772	lqtvszjkltcexgh.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
772	lqtvszjkltcexgh.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
772	lqtvszjkltcexgh.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
772	lqtvszjkltcexgh.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
772	lqtvszjkltcexgh.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
772	lqtvszjkltcexgh.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
772	lqtvszjkltcexgh.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
772	lqtvszjkltcexgh.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
772	lqtvszjkltcexgh.exe
1076	hhqjbzoligihs.exe

Suspicious use of FindShellTrayWindow 18 IoCs

Processes:

604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exeglzzmmfneo.exelqtvszjkltcexgh.exealeomyqr.exehhqjbzoligihs.exealeomyqr.exe

pid	process
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
948	glzzmmfneo.exe
948	glzzmmfneo.exe
948	glzzmmfneo.exe
772	lqtvszjkltcexgh.exe
772	lqtvszjkltcexgh.exe
772	lqtvszjkltcexgh.exe
768	aleomyqr.exe
768	aleomyqr.exe
768	aleomyqr.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
860	aleomyqr.exe
860	aleomyqr.exe
860	aleomyqr.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exeglzzmmfneo.exelqtvszjkltcexgh.exealeomyqr.exehhqjbzoligihs.exealeomyqr.exe

pid	process
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
948	glzzmmfneo.exe
948	glzzmmfneo.exe
948	glzzmmfneo.exe
772	lqtvszjkltcexgh.exe
772	lqtvszjkltcexgh.exe
772	lqtvszjkltcexgh.exe
768	aleomyqr.exe
768	aleomyqr.exe
768	aleomyqr.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
1076	hhqjbzoligihs.exe
860	aleomyqr.exe
860	aleomyqr.exe
860	aleomyqr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1552 WINWORD.EXE
1552 WINWORD.EXE

pid	process
1552	WINWORD.EXE
1552	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exeglzzmmfneo.exeWINWORD.EXE

description	pid	process	target process
PID 1792 wrote to memory of 948	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	glzzmmfneo.exe
PID 1792 wrote to memory of 948	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	glzzmmfneo.exe
PID 1792 wrote to memory of 948	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	glzzmmfneo.exe
PID 1792 wrote to memory of 948	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	glzzmmfneo.exe
PID 1792 wrote to memory of 772	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	lqtvszjkltcexgh.exe
PID 1792 wrote to memory of 772	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	lqtvszjkltcexgh.exe
PID 1792 wrote to memory of 772	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	lqtvszjkltcexgh.exe
PID 1792 wrote to memory of 772	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	lqtvszjkltcexgh.exe
PID 1792 wrote to memory of 768	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	aleomyqr.exe
PID 1792 wrote to memory of 768	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	aleomyqr.exe
PID 1792 wrote to memory of 768	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	aleomyqr.exe
PID 1792 wrote to memory of 768	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	aleomyqr.exe
PID 1792 wrote to memory of 1076	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	hhqjbzoligihs.exe
PID 1792 wrote to memory of 1076	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	hhqjbzoligihs.exe
PID 1792 wrote to memory of 1076	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	hhqjbzoligihs.exe
PID 1792 wrote to memory of 1076	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	hhqjbzoligihs.exe
PID 948 wrote to memory of 860	948	glzzmmfneo.exe	aleomyqr.exe
PID 948 wrote to memory of 860	948	glzzmmfneo.exe	aleomyqr.exe
PID 948 wrote to memory of 860	948	glzzmmfneo.exe	aleomyqr.exe
PID 948 wrote to memory of 860	948	glzzmmfneo.exe	aleomyqr.exe
PID 1792 wrote to memory of 1552	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	WINWORD.EXE
PID 1792 wrote to memory of 1552	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	WINWORD.EXE
PID 1792 wrote to memory of 1552	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	WINWORD.EXE
PID 1792 wrote to memory of 1552	1792	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	WINWORD.EXE
PID 1552 wrote to memory of 672	1552	WINWORD.EXE	splwow64.exe
PID 1552 wrote to memory of 672	1552	WINWORD.EXE	splwow64.exe
PID 1552 wrote to memory of 672	1552	WINWORD.EXE	splwow64.exe
PID 1552 wrote to memory of 672	1552	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
"C:\Users\Admin\AppData\Local\Temp\604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\glzzmmfneo.exe
glzzmmfneo.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\aleomyqr.exe
C:\Windows\system32\aleomyqr.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:860

C:\Windows\SysWOW64\lqtvszjkltcexgh.exe
lqtvszjkltcexgh.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:772

C:\Windows\SysWOW64\aleomyqr.exe
aleomyqr.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:768

C:\Windows\SysWOW64\hhqjbzoligihs.exe
hhqjbzoligihs.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1076

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:672

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
Filesize
255KB

MD5
f4ff75367694daf94b7e57ae617b8db5

SHA1
a280780efe97a6ddfbb8907b8a592ae009098d90

SHA256
1c0e6cba7495aad5f14796b258257bed3926223fe863347b88fbfbee6fecad42

SHA512
51cecf9231b07f47d5082ac1013d04e87ae157ed94330e3ef9b91d02de81c53bddf51f383fb294515ad5ab826b041b99fb01b2ab10c2c8b60b6cd5c35fc2e80e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
Filesize
255KB

MD5
0f1232240fe19a8737170fe1eada9c3b

SHA1
e42980ed103889eb6e39b6324cc9b0b5fc8c138f

SHA256
b8ec7cb779a820ab0835221811bc15d5db8958f47baea5dabba305397b5745ef

SHA512
6a17782bfec284c744b4a918acee0a393daf64dc1cb0e31608c13794f4caa916f6d8d6915027ac7d7fc090adcd53684e7989b5b7878c98c8a7bb65877f2446b7

Download Submit
C:\Users\Admin\AppData\Roaming\ReceiveStart.doc.exe
Filesize
255KB

MD5
5bc72908d8d1e2984e3d0ccc7e40a2d7

SHA1
425053d9b0dce4796072c3ef51ff485c2f45707f

SHA256
f8780a2a85707c2895bc3972a295ce7906ea5056267144fe9799441afceb3937

SHA512
4aeb01e181cce31a2aab60e768fd90ce1953c1496cf577b07b8f779c11c4d6b1692d95ceac5fd8799bc350b2c329eae977f67c8de51cbff2fc467193f3b7eab9

Download Submit
C:\Users\Admin\Music\RepairAssert.doc.exe
Filesize
255KB

MD5
c050fc9c96874d69e123b4597b6b53ee

SHA1
0d91060a978d38c5a928c5fb49d3789a277f0a92

SHA256
ac6f2303f330be66174c8dc14a3b6da500a745adb252ed795b2b1731f96e0897

SHA512
17c42624044325c1be0c0d93372d4b08944f237e35f805cad9df0c5345080be4093baa421a341d8c1078278e489645905fe18e18a8656ec75d284631a5a30ce8

Download Submit
C:\Windows\SysWOW64\aleomyqr.exe
Filesize
255KB

MD5
d2f8604534fd6c2d7a6fb3760280d732

SHA1
13636ef4b8db2db2e08961d2ab9cd4353585b1c6

SHA256
a89dc3a684ee2288d56203b99b8271a291486442c77f28a2ef959f6b7caec5a5

SHA512
a569d86bc947165e37125e3a810b947785c80cd28ecfb7526eebe01e60fb4c10bdbf059b526493d5786b2f9d7cd90979670f6c0f72ee901df5667d4b2c0dde3c

Download Submit
C:\Windows\SysWOW64\aleomyqr.exe
Filesize
255KB

MD5
d2f8604534fd6c2d7a6fb3760280d732

SHA1
13636ef4b8db2db2e08961d2ab9cd4353585b1c6

SHA256
a89dc3a684ee2288d56203b99b8271a291486442c77f28a2ef959f6b7caec5a5

SHA512
a569d86bc947165e37125e3a810b947785c80cd28ecfb7526eebe01e60fb4c10bdbf059b526493d5786b2f9d7cd90979670f6c0f72ee901df5667d4b2c0dde3c

Download Submit
C:\Windows\SysWOW64\aleomyqr.exe
Filesize
255KB

MD5
d2f8604534fd6c2d7a6fb3760280d732

SHA1
13636ef4b8db2db2e08961d2ab9cd4353585b1c6

SHA256
a89dc3a684ee2288d56203b99b8271a291486442c77f28a2ef959f6b7caec5a5

SHA512
a569d86bc947165e37125e3a810b947785c80cd28ecfb7526eebe01e60fb4c10bdbf059b526493d5786b2f9d7cd90979670f6c0f72ee901df5667d4b2c0dde3c

Download Submit
C:\Windows\SysWOW64\glzzmmfneo.exe
Filesize
255KB

MD5
0b6265ea643aa9ce8dd0825744593446

SHA1
ee8053f9e40ee7b3fcbe388c1dd8a851a201d692

SHA256
8fe6fa54fa0a8aa423a5fb6f4a8daa1512277932945828deba4eb5b7d71dea11

SHA512
7f6c187b7be0006d0dd9827643328389c0d0dd4967436c3dcf2a7ccf9c046e895911e9b92df9401e84c5a753f4cdad20a62f7d589dc50dafc13ab7e1e52ee755

Download Submit
C:\Windows\SysWOW64\glzzmmfneo.exe
Filesize
255KB

MD5
0b6265ea643aa9ce8dd0825744593446

SHA1
ee8053f9e40ee7b3fcbe388c1dd8a851a201d692

SHA256
8fe6fa54fa0a8aa423a5fb6f4a8daa1512277932945828deba4eb5b7d71dea11

SHA512
7f6c187b7be0006d0dd9827643328389c0d0dd4967436c3dcf2a7ccf9c046e895911e9b92df9401e84c5a753f4cdad20a62f7d589dc50dafc13ab7e1e52ee755

Download Submit
C:\Windows\SysWOW64\hhqjbzoligihs.exe
Filesize
255KB

MD5
5cc334881c99cdebd0b84d5716c0ba83

SHA1
9733069d4d71231f5d0dfc0f9231d1f18233b1d6

SHA256
69e692fa9cc376b092ace63622d16b899fd21db380f47a9cd0e52a79e5ce3dd7

SHA512
091c33105783d5fb4ec3c43c8d6bd2097956aeb501edadef46e559759e5bee083f5f4a0d831cab4302d8854eff945ccd5e5a2496432dc7c769461f4460a482f6

Download Submit
C:\Windows\SysWOW64\hhqjbzoligihs.exe
Filesize
255KB

MD5
5cc334881c99cdebd0b84d5716c0ba83

SHA1
9733069d4d71231f5d0dfc0f9231d1f18233b1d6

SHA256
69e692fa9cc376b092ace63622d16b899fd21db380f47a9cd0e52a79e5ce3dd7

SHA512
091c33105783d5fb4ec3c43c8d6bd2097956aeb501edadef46e559759e5bee083f5f4a0d831cab4302d8854eff945ccd5e5a2496432dc7c769461f4460a482f6

Download Submit
C:\Windows\SysWOW64\lqtvszjkltcexgh.exe
Filesize
255KB

MD5
15d7c500525c5e3a56942d98bcde1c4c

SHA1
eb8b35eaab724b2c927b7622ebfd589dafb64263

SHA256
337f10fe7c8a1607744d59917ac61d893d798c0b068f8edcc84f2a87aedb17c6

SHA512
f340babc4b49092024e84889a03cc4ff9d33967f64a5ba1a25ee5fffc86757ba6c5299d6b504b54e7fc16c03201a549e6132ce0871b53a9ab5f8cfb6171f6049

Download Submit
C:\Windows\SysWOW64\lqtvszjkltcexgh.exe
Filesize
255KB

MD5
15d7c500525c5e3a56942d98bcde1c4c

SHA1
eb8b35eaab724b2c927b7622ebfd589dafb64263

SHA256
337f10fe7c8a1607744d59917ac61d893d798c0b068f8edcc84f2a87aedb17c6

SHA512
f340babc4b49092024e84889a03cc4ff9d33967f64a5ba1a25ee5fffc86757ba6c5299d6b504b54e7fc16c03201a549e6132ce0871b53a9ab5f8cfb6171f6049

Download Submit
C:\Windows\mydoc.rtf
Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\??\c:\Users\Admin\AppData\Roaming\ReceiveStart.doc.exe
Filesize
255KB

MD5
5bc72908d8d1e2984e3d0ccc7e40a2d7

SHA1
425053d9b0dce4796072c3ef51ff485c2f45707f

SHA256
f8780a2a85707c2895bc3972a295ce7906ea5056267144fe9799441afceb3937

SHA512
4aeb01e181cce31a2aab60e768fd90ce1953c1496cf577b07b8f779c11c4d6b1692d95ceac5fd8799bc350b2c329eae977f67c8de51cbff2fc467193f3b7eab9

Download Submit
\Windows\SysWOW64\aleomyqr.exe
Filesize
255KB

MD5
d2f8604534fd6c2d7a6fb3760280d732

SHA1
13636ef4b8db2db2e08961d2ab9cd4353585b1c6

SHA256
a89dc3a684ee2288d56203b99b8271a291486442c77f28a2ef959f6b7caec5a5

SHA512
a569d86bc947165e37125e3a810b947785c80cd28ecfb7526eebe01e60fb4c10bdbf059b526493d5786b2f9d7cd90979670f6c0f72ee901df5667d4b2c0dde3c

Download Submit
\Windows\SysWOW64\aleomyqr.exe
Filesize
255KB

MD5
d2f8604534fd6c2d7a6fb3760280d732

SHA1
13636ef4b8db2db2e08961d2ab9cd4353585b1c6

SHA256
a89dc3a684ee2288d56203b99b8271a291486442c77f28a2ef959f6b7caec5a5

SHA512
a569d86bc947165e37125e3a810b947785c80cd28ecfb7526eebe01e60fb4c10bdbf059b526493d5786b2f9d7cd90979670f6c0f72ee901df5667d4b2c0dde3c

Download Submit
\Windows\SysWOW64\glzzmmfneo.exe
Filesize
255KB

MD5
0b6265ea643aa9ce8dd0825744593446

SHA1
ee8053f9e40ee7b3fcbe388c1dd8a851a201d692

SHA256
8fe6fa54fa0a8aa423a5fb6f4a8daa1512277932945828deba4eb5b7d71dea11

SHA512
7f6c187b7be0006d0dd9827643328389c0d0dd4967436c3dcf2a7ccf9c046e895911e9b92df9401e84c5a753f4cdad20a62f7d589dc50dafc13ab7e1e52ee755

Download Submit
\Windows\SysWOW64\hhqjbzoligihs.exe
Filesize
255KB

MD5
5cc334881c99cdebd0b84d5716c0ba83

SHA1
9733069d4d71231f5d0dfc0f9231d1f18233b1d6

SHA256
69e692fa9cc376b092ace63622d16b899fd21db380f47a9cd0e52a79e5ce3dd7

SHA512
091c33105783d5fb4ec3c43c8d6bd2097956aeb501edadef46e559759e5bee083f5f4a0d831cab4302d8854eff945ccd5e5a2496432dc7c769461f4460a482f6

Download Submit
\Windows\SysWOW64\lqtvszjkltcexgh.exe
Filesize
255KB

MD5
15d7c500525c5e3a56942d98bcde1c4c

SHA1
eb8b35eaab724b2c927b7622ebfd589dafb64263

SHA256
337f10fe7c8a1607744d59917ac61d893d798c0b068f8edcc84f2a87aedb17c6

SHA512
f340babc4b49092024e84889a03cc4ff9d33967f64a5ba1a25ee5fffc86757ba6c5299d6b504b54e7fc16c03201a549e6132ce0871b53a9ab5f8cfb6171f6049

Download Submit
memory/672-106-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmp

Filesize
8KB

Download
memory/672-105-0x0000000000000000-mapping.dmp

Download
memory/768-66-0x0000000000000000-mapping.dmp

Download
memory/768-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/768-83-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/772-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/772-61-0x0000000000000000-mapping.dmp

Download
memory/772-80-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/860-79-0x0000000000000000-mapping.dmp

Download
memory/860-93-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/860-99-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/948-56-0x0000000000000000-mapping.dmp

Download
memory/948-77-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/948-92-0x0000000003CC0000-0x0000000003D60000-memory.dmp

Filesize
640KB

Download
memory/948-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1076-98-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1076-70-0x0000000000000000-mapping.dmp

Download
memory/1076-84-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1552-91-0x00000000710BD000-0x00000000710C8000-memory.dmp

Filesize
44KB

Download
memory/1552-85-0x0000000000000000-mapping.dmp

Download
memory/1552-89-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1552-88-0x00000000700D1000-0x00000000700D3000-memory.dmp

Filesize
8KB

Download
memory/1552-87-0x0000000072651000-0x0000000072654000-memory.dmp

Filesize
12KB

Download
memory/1552-107-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1552-108-0x00000000710BD000-0x00000000710C8000-memory.dmp

Filesize
44KB

Download
memory/1792-54-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/1792-76-0x00000000023F0000-0x0000000002490000-memory.dmp

Filesize
640KB

Download
memory/1792-75-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1792-86-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads